Need Help with Restricting Incident Assignment Based on Group Name and Type

Hello Everyone,

I have a requirement where any group with AP in the name and type not equal to ITIL should not be assignable for incidents. However, there are two groups that also have AP in their name, but their type is ITIL, and these should not be restricted. I tried to implement this using a Business Rule, but it's currently restricting all AP groups regardless of their type.

Could anyone please help me fine-tune the logic or suggest a better approach?

Thank you.